@mutmutco/cli 3.69.0 → 3.70.0

package/dist/main.cjs

@@ -33,9 +33,11 @@ __export(index_exports, {
   DEFAULT_PRIORITY: () => DEFAULT_PRIORITY,
   awsCallerArn: () => awsCallerArn,
   classifyParseError: () => classifyParseError,
+  commandOwnLongFlags: () => commandOwnLongFlags,
   envHealLockPath: () => envHealLockPath,
   gcPlan: () => gcPlan,
   isOrgRegisteredRepo: () => isOrgRegisteredRepo,
+  positionalTargetForm: () => positionalTargetForm,
   registryClientDeps: () => registryClientDeps,
   repoSlug: () => repoSlug,
   shouldMarkWorktreeActivity: () => shouldMarkWorktreeActivity,
@@ -7752,7 +7754,13 @@ function collectRegistryRepos(projects) {
   if (![...seen].some((r) => r.toLowerCase() === HUB_REPO.toLowerCase())) seen.add(HUB_REPO);
   return [...seen].sort((a, b) => a.localeCompare(b));
 }
-async function resolveRepoMergeCiPolicy(repo, deps) {
+async function prTriggeredWorkflowsOnRef(deps, repo, branch, repoClass) {
+  const hasGate = repoClass === "hub" ? true : await contentExists(deps, repo, branch, PRODUCT_GATE_PATH);
+  const workflowPaths = repoClass === "hub" ? [".github/workflows/gate.yml"] : hasGate ? [PRODUCT_GATE_PATH] : await listWorkflowPaths(deps, repo, branch);
+  if (workflowPaths === void 0) return void 0;
+  return filterPullRequestTriggered(deps, repo, branch, workflowPaths);
+}
+async function resolveRepoMergeCiPolicy(repo, deps, headRef) {
   const meta = await deps.getProjectMeta(slugFromRepo(repo));
   const repoClass = classifyRepo(repo, meta);
   if (repoClass === "content") {
@@ -7763,17 +7771,25 @@ async function resolveRepoMergeCiPolicy(repo, deps) {
     });
   }
   const baseBranch = "development";
-  const hasGate = repoClass === "hub" ? true : await contentExists(deps, repo, baseBranch, PRODUCT_GATE_PATH);
-  const workflowPaths = repoClass === "hub" ? [".github/workflows/gate.yml"] : hasGate ? [PRODUCT_GATE_PATH] : await listWorkflowPaths(deps, repo, baseBranch);
-  if (workflowPaths === void 0) {
+  const prTriggered = await prTriggeredWorkflowsOnRef(deps, repo, baseBranch, repoClass);
+  if (prTriggered === void 0) {
     return { policy: "wait-for-checks", reason: "workflows listing unreadable (API error) \u2014 failing safe to wait-for-checks" };
   }
-  const prTriggered = await filterPullRequestTriggered(deps, repo, baseBranch, workflowPaths);
-  return resolveMergeCiPolicy({
-    workflowPaths: prTriggered,
+  let effective = prTriggered;
+  let headReason = "";
+  if (!effective.length && headRef && headRef !== baseBranch) {
+    const onHead = await prTriggeredWorkflowsOnRef(deps, repo, headRef, repoClass);
+    if (onHead?.length) {
+      effective = onHead;
+      headReason = ` (on PR head ${headRef}; absent on ${baseBranch})`;
+    }
+  }
+  const resolved = resolveMergeCiPolicy({
+    workflowPaths: effective,
     registryCi: meta?.ci,
     registryRequiredChecks: meta?.requiredChecks
   });
+  return headReason ? { ...resolved, reason: `${resolved.reason}${headReason}` } : resolved;
 }
 async function filterPullRequestTriggered(deps, repo, branch, paths) {
   const kept = [];
@@ -9465,7 +9481,8 @@ var OWNER = "mutmutco";
 var SSM_ROOT = "/mmi-future";
 var PROJECT_TIER_SEGMENT = "dev";
 var ORG_INFRA_SLUG = "_org";
-var KEY_RE = /^(?:[a-z][a-z0-9-]*\/)?[A-Za-z][A-Za-z0-9_]*$/;
+var KEY_MAX_PATH_SEGMENTS = 4;
+var KEY_RE = new RegExp(`^(?:[a-z0-9][a-z0-9-]*/){0,${KEY_MAX_PATH_SEGMENTS}}[A-Za-z][A-Za-z0-9_]*$`);
 function isValidSecretKey(key) {
   if (!key || key.length > 256) return false;
   if (key.includes("..") || key.startsWith("/") || key.includes("*")) return false;
@@ -9664,7 +9681,7 @@ function formatCapabilities(r) {
 no vault credentials visible`;
   const width = Math.max(...items.map((i) => i.scope.length));
   const lines = items.map(
-    (i) => `${i.accessible ? "+" : " "} ${i.scope.padEnd(width)}  ${i.tier.padEnd(7)} ${i.reason}`
+    (i) => `${i.accessible ? "+" : " "} ${i.scope.padEnd(width)}  ${i.tier.padEnd(7)} ${i.grantScope ? `${i.reason} (${i.grantScope})` : i.reason}`
   );
   const reachable = items.filter((i) => i.accessible).length;
   return [
@@ -9675,6 +9692,7 @@ no vault credentials visible`;
     ...lines,
     "",
     "+ = usable now. Consume keyless: `mmi-cli secrets use <KEY> -- <cmd>` (inject, never printed); validate: `mmi-cli secrets verify <KEY>`. No command prints a raw value (#2844).",
+    "  `grant (read)` = keyless use only \u2014 rotating or removing that key still needs an rw grant (#3652).",
     `  Org-infra (#3463): \`--slug\` is ALWAYS \`${ORG_INFRA_SLUG}\`; the provider is the key's FIRST SEGMENT \u2014 \`mmi-cli secrets use cloudflare/GLOBAL_API_KEY --slug ${ORG_INFRA_SLUG} -- <cmd>\` (master-gated).`
   ].join("\n");
 }
@@ -10339,11 +10357,29 @@ async function secretsRemove(deps, key, opts) {
   }
   deps.log(`removed ${key}`);
 }
-async function secretsGrant(deps, repo, login, key, _opts) {
+var WILDCARD_GRANT_KEY_RE = /^(?:[a-z][a-z0-9-]*\/)?\*$/;
+function isWildcardGrantKey(key) {
+  return WILDCARD_GRANT_KEY_RE.test(key);
+}
+function isValidGrantKey(key) {
+  if (!key || key.length > 256) return false;
+  if (key.includes("..") || key.startsWith("/")) return false;
+  return isWildcardGrantKey(key) || isValidSecretKey(key);
+}
+async function secretsGrant(deps, repo, login, key, opts) {
+  if (!isValidGrantKey(key)) {
+    deps.err(`invalid grant key ${JSON.stringify(key)} \u2014 expected <provider>/<KEY>, or a read-only wildcard \`*\` / \`<provider>/*\``);
+    return;
+  }
+  if (isWildcardGrantKey(key) && !opts.read) {
+    deps.err(`secrets grant: ${key} is a wildcard \u2014 pass --read. A wildcard never confers write, so granting it rw is refused rather than silently narrowed.`);
+    return;
+  }
+  const scope = opts.read ? "read" : "rw";
   const res = await deps.fetch(`${deps.apiUrl}/secrets/grant`, {
     method: "POST",
     headers: await deps.headers({ "content-type": "application/json" }),
-    body: JSON.stringify({ repo, login, key }),
+    body: JSON.stringify({ repo, login, key, scope }),
     signal: AbortSignal.timeout(TIMEOUT_MS)
   });
   if (!res.ok) {
@@ -10352,7 +10388,7 @@ async function secretsGrant(deps, repo, login, key, _opts) {
     );
     return;
   }
-  deps.log(`granted @${login} access to ${key} in ${repo}`);
+  deps.log(`granted @${login} ${scope === "read" ? "read-only" : "read/write"} access to ${key} in ${repo}`);
 }
 async function secretsRevoke(deps, repo, login, key, _opts) {
   const res = await deps.fetch(`${deps.apiUrl}/secrets/revoke`, {
@@ -15944,12 +15980,15 @@ async function resolveOwners(deps) {
 function collaboratorRole(c) {
   return c.role_name ?? (c.permissions?.admin ? "admin" : c.permissions?.maintain ? "maintain" : "write");
 }
-async function auditRepoCollaborators(repo, owners, deps) {
+async function auditRepoCollaborators(repo, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), sanctionedAdmins = /* @__PURE__ */ new Set()) {
   const collabs = await restPagedJson(deps, `repos/${repo}/collaborators?affiliation=direct`, []);
   const findings = [];
+  const writeOrBetter = /* @__PURE__ */ new Set();
   for (const c of collabs) {
     if (owners.has(c.login)) continue;
     const role = collaboratorRole(c);
+    writeOrBetter.add(c.login);
+    if (OVERGRANT_ROLES.has(role) && sanctionedAdmins.has(c.login)) continue;
     if (OVERGRANT_ROLES.has(role)) {
       findings.push({
         repo,
@@ -15961,6 +16000,17 @@ async function auditRepoCollaborators(repo, owners, deps) {
       });
     }
   }
+  for (const login of projectAdmins) {
+    if (owners.has(login) || writeOrBetter.has(login)) continue;
+    findings.push({
+      repo,
+      kind: "collaborator-undergrant",
+      severity: "medium",
+      actor: login,
+      detail: `@${login} is a declared project-admin of ${repo} in the registry but holds no direct collaborator role; secrets self-serve and train authority fail closed for them`,
+      remediation: `gh api -X PUT repos/${repo}/collaborators/${login} -f permission=push`
+    });
+  }
   return findings;
 }
 async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @__PURE__ */ new Set()) {
@@ -16008,6 +16058,18 @@ async function auditTrainBranch(repo, branch, owners, deps, projectAdmins = /* @
       });
     }
   }
+  for (const login of projectAdmins) {
+    if (owners.has(login) || users.includes(login)) continue;
+    findings.push({
+      repo,
+      branch,
+      kind: "train-allowlist-missing",
+      severity: "medium",
+      actor: login,
+      detail: `declared project-admin @${login} is missing from the ${branch} push allowlist \u2014 the registry grants them train authority the branch lock denies`,
+      remediation: `gh api -X POST repos/${repo}/branches/${branch}/protection/restrictions/users -f users[]="${login}"`
+    });
+  }
   const apps = (restrictions.apps ?? []).map((a) => a.slug);
   if (!apps.includes(LOCKED_APP)) {
     findings.push({
@@ -16040,9 +16102,9 @@ function auditDataAccessContracts(repo, contracts = { consumers: {} }) {
   }
   return findings;
 }
-async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), dataAccess, releaseTrack) {
+async function auditRepoAccess(repo, repoClass, owners, deps, projectAdmins = /* @__PURE__ */ new Set(), dataAccess, releaseTrack, sanctionedAdmins = /* @__PURE__ */ new Set()) {
   const findings = [];
-  findings.push(...await auditRepoCollaborators(repo, owners, deps));
+  findings.push(...await auditRepoCollaborators(repo, owners, deps, projectAdmins, sanctionedAdmins));
   if (dataAccess) findings.push(...auditDataAccessContracts(repo, dataAccess));
   const track = releaseTrack ?? (repoClass === "content" ? "trunk" : void 0);
   for (const branch of lockedBranches(repoClass, track)) {
@@ -16082,7 +16144,7 @@ async function auditPluginReadAccess(owners, projectAdmins, deps) {
   }
   return findings;
 }
-async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
+async function auditOrgAccess(targets, deps, matrix = {}, dataAccess, sanctioned = {}) {
   if (targets.length === 0) {
     return {
       ok: false,
@@ -16119,7 +16181,16 @@ async function auditOrgAccess(targets, deps, matrix = {}, dataAccess) {
   orgFindings.push(...await auditPluginReadAccess(owners, allProjectAdmins, deps));
   const repos = [];
   for (const target of targets) {
-    repos.push(await auditRepoAccess(target.repo, target.class, owners, deps, new Set(entriesValueByCanonicalRepo(matrix, target.repo) ?? []), dataAccess, target.releaseTrack));
+    repos.push(await auditRepoAccess(
+      target.repo,
+      target.class,
+      owners,
+      deps,
+      new Set(entriesValueByCanonicalRepo(matrix, target.repo) ?? []),
+      dataAccess,
+      target.releaseTrack,
+      new Set(entriesValueByCanonicalRepo(sanctioned, target.repo) ?? [])
+    ));
   }
   const ok = orgFindings.every((f) => f.severity !== "high") && repos.every((r) => r.ok);
   return { ok, owners: [...owners], orgFindings, repos };
@@ -16158,6 +16229,10 @@ function loadAccessMatrix(matrixJson) {
   if (!matrixJson) return {};
   return safeJson(matrixJson, {}).projectAdmins ?? {};
 }
+function loadSanctionedAdmins(matrixJson) {
+  if (!matrixJson) return {};
+  return safeJson(matrixJson, {}).sanctionedAdmins ?? {};
+}
 function loadDataAccessContracts(dataAccessJson) {
   if (!dataAccessJson) return { consumers: {} };
   const parsed = safeJson(dataAccessJson, { consumers: {} });
@@ -18073,8 +18148,8 @@ function registerSecretsCommands(program3) {
       if (ok === false) process.exitCode = 1;
     });
   });
-  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to one specific org-infra secret").action((repo, login, key) => withSecrets((d) => secretsGrant(d, repo, login, key, {})));
-  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-infra secret access").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
+  secrets.command("grant <repo> <login> <key>").description("MASTER-ONLY: grant a project-admin standing access to an org-infra secret. Default is read/write on one exact key; --read grants keyless USE only, and only --read accepts a wildcard key (`*` = the whole namespace, `<provider>/*` = one provider group) (#3652)").option("--read", "read-only: permits keyless `secrets use`, never `set`/`rm`. Required for a wildcard key.").action((repo, login, key, o) => withSecrets((d) => secretsGrant(d, repo, login, key, { read: o.read })));
+  secrets.command("revoke <repo> <login> <key>").description("MASTER-ONLY: withdraw a previously granted org-infra secret access (pass the grant key exactly as granted, wildcard included)").action((repo, login, key) => withSecrets((d) => secretsRevoke(d, repo, login, key, {})));
 }
 
 // src/app-actor.ts
@@ -25801,23 +25876,6 @@ async function requireFreshTrainCli(commandName) {
   if (report.ok) return;
   throw new Error(staleTrainCliMessage(report, commandName));
 }
-var cachedLongFlags;
-function allLongFlags() {
-  if (cachedLongFlags) return cachedLongFlags;
-  const acc = /* @__PURE__ */ new Set();
-  const walk2 = (node) => {
-    if (!isCanonicalSuggestion(node)) return;
-    for (const opt of node.options) {
-      if (opt.discovery) continue;
-      const m = /--[\w-]+/.exec(opt.flags);
-      if (m) acc.add(m[0]);
-    }
-    for (const child2 of node.subcommands) walk2(child2);
-  };
-  walk2(buildCommandManifest(program2).tree);
-  cachedLongFlags = [...acc];
-  return cachedLongFlags;
-}
 var cachedCommandPaths;
 function allCommandPaths() {
   if (cachedCommandPaths) return cachedCommandPaths;
@@ -25884,6 +25942,22 @@ function commandPath2(cmd) {
   }
   return parts.join(" ");
 }
+function commandOwnLongFlags(cmd) {
+  if (!cmd) return [];
+  const flags = /* @__PURE__ */ new Set();
+  for (const opt of cmd.options) {
+    if (opt.long) flags.add(opt.long);
+  }
+  return [...flags];
+}
+var TARGET_SELECTOR_FLAGS = /* @__PURE__ */ new Set(["--repo", "--ref", "--target", "--project"]);
+function positionalTargetForm(cmd) {
+  if (!cmd) return void 0;
+  const args = cmd.registeredArguments ?? [];
+  const first = args[0];
+  if (!first) return void 0;
+  return `mmi-cli ${commandPath2(cmd)} <${first.name()}>`;
+}
 function resolveParseHint() {
   if (lastParseErrorKind === "unknown-command") {
     const path3 = lastUnknownCommand ? suggestCommandPath(lastUnknownCommand, allCommandPaths()) : void 0;
@@ -25912,10 +25986,13 @@ function envelopeAwareWriteErr(str) {
   if (match) {
     const flag = match[1];
     if (argvWantsJson2()) {
-      const suggestion = didYouMean(flag, allLongFlags());
+      const invoked = resolveCommandFromArgv(program2, process.argv.slice(2));
+      const suggestion = didYouMean(flag, commandOwnLongFlags(invoked));
       const corrected = suggestion ? `mmi-cli ${process.argv.slice(2).map((a) => a === flag ? suggestion : a).join(" ")}` : void 0;
+      const positional = !suggestion && TARGET_SELECTOR_FLAGS.has(flag) ? positionalTargetForm(invoked) : void 0;
+      const message = positional ? `unknown option '${flag}' \u2014 this command takes its target as a positional: ${positional}` : `unknown option '${flag}'`;
       process.stderr.write(
-        formatErrorEnvelope(`unknown option '${flag}'`, {
+        formatErrorEnvelope(message, {
           code: ERROR_CODES.ERR_UNKNOWN_FLAG,
           offending_flag: flag,
           ...suggestion ? { did_you_mean: suggestion } : {},
@@ -27371,14 +27448,19 @@ async function listCiWorkflowPaths(cwd = process.cwd()) {
     }
   }).map((name) => `.github/workflows/${name}`);
 }
-async function resolveMergeCiPolicyForCheckout(repoOpt) {
+async function resolveMergeCiPolicyForCheckout(repoOpt, headRef) {
   const repo = repoOpt ?? await resolveRepo();
   if (repo) {
-    return resolveRepoMergeCiPolicy(repo, ciAuditDeps());
+    return resolveRepoMergeCiPolicy(repo, ciAuditDeps(), headRef);
   }
   const workflowPaths = await listCiWorkflowPaths();
   return resolveMergeCiPolicy({ workflowPaths });
 }
+async function prHeadRefForCiProbe(prNumber, repo) {
+  const snapshot = await fetchRestPrSnapshot(prNumber, repo).catch(() => null);
+  if (!snapshot || snapshot.headIsFork || !snapshot.headRef) return void 0;
+  return snapshot.headRef;
+}
 function ciAuditDeps() {
   const cfgPromise = loadConfig();
   const root = hubRoot();
@@ -27417,9 +27499,11 @@ pr.command("checks-wait <number>").description(`bounded wait for PR checks; skip
     timeoutMs = Math.round(minutes * 6e4);
   }
   const repo = await requireRepo(o.repo);
-  const baseBranch = await fetchRestPrSnapshot(number, repo).then((s) => s.baseRef).catch(() => "development");
+  const snapshot = await fetchRestPrSnapshot(number, repo).catch(() => null);
+  const baseBranch = snapshot?.baseRef ?? "development";
+  const ciHeadRef = snapshot && !snapshot.headIsFork && snapshot.headRef ? snapshot.headRef : void 0;
   const result = await waitForPrChecks({
-    resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
+    resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef),
     pollChecks: () => pollRestPrChecks(number, repo),
     pollMergeable: () => pollRestPrMergeable(number, repo),
     pollRateLimit: () => fetchRestCorePool(),
@@ -27564,12 +27648,13 @@ jsonParity(pr.command("merge <number>").description("merge a PR (squash by defau
   const beforeWorktrees = parseWorktreePorcelain(
     (await execFileP2("git", ["worktree", "list", "--porcelain"], { timeout: GIT_TIMEOUT_MS }).catch(() => ({ stdout: "" }))).stdout
   );
-  const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo);
+  const ciHeadRef = repoForPostCleanup ? await prHeadRefForCiProbe(number, repoForPostCleanup) : void 0;
+  const ciPolicy = await resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef);
   if (o.wait) {
     const repo = await requireRepo(o.repo);
     const baseBranch = await fetchRestPrSnapshot(number, repo).then((s) => s.baseRef).catch(() => "development");
     const wait = await waitForPrChecks({
-      resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo),
+      resolvePolicy: () => resolveMergeCiPolicyForCheckout(o.repo, ciHeadRef),
       pollChecks: () => pollRestPrChecks(number, repo),
       pollMergeable: () => pollRestPrMergeable(number, repo),
       pollRateLimit: () => fetchRestCorePool(),
@@ -28031,7 +28116,8 @@ access.command("audit").description("audit collaborator roles + train-branch pus
   const derivedContracts = registryProjects ? dataAccessContractsFromProjects(registryProjects) : { consumers: {} };
   const fileContracts = (0, import_node_fs33.existsSync)("data-access-contracts.json") ? loadDataAccessContracts((0, import_node_fs33.readFileSync)("data-access-contracts.json", "utf8")) : { consumers: {} };
   const dataAccess = mergeDataAccessContracts(fileContracts, derivedContracts);
-  const report = await auditOrgAccess(targets, deps, matrix, dataAccess);
+  const sanctioned = (0, import_node_fs33.existsSync)("access-matrix.json") ? loadSanctionedAdmins((0, import_node_fs33.readFileSync)("access-matrix.json", "utf8")) : {};
+  const report = await auditOrgAccess(targets, deps, matrix, dataAccess, sanctioned);
   console.log(o.json ? JSON.stringify(report, null, 2) : renderAccessReport(report));
   if (!report.ok) process.exitCode = 1;
 });
@@ -28214,9 +28300,11 @@ program2.parseAsync(process.argv).then(() => finishCliRun()).catch((e) => failGr
   DEFAULT_PRIORITY,
   awsCallerArn,
   classifyParseError,
+  commandOwnLongFlags,
   envHealLockPath,
   gcPlan,
   isOrgRegisteredRepo,
+  positionalTargetForm,
   registryClientDeps,
   repoSlug,
   shouldMarkWorktreeActivity,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mutmutco/cli",
-  "version": "3.69.0",
+  "version": "3.70.0",
   "description": "MMI Future CLI — the org dev toolbox (board, registry, keyless secrets, release train, bootstrap, doctor) and the cross-IDE engine the plugin's session-start hook drives.",
   "type": "module",
   "license": "UNLICENSED",